Physical Security: CIP-003-9 R2

Physical security continues to be an area of focus due to the potential impact that physical threats can have on the reliability of the Bulk Electric System (BES). As the electric industry addresses the broad range of security challenges, such as unauthorized access, vandalism, and the potential for coordinated cyber and physical threats, maintaining effective physical security controls is an essential component of any risk-based security program.

Responsible Entities can support this risk-based approach by ensuring their physical security controls align with CIP-003-9 Requirement 2, which establishes the need to control physical access to assets that contain low impact BES Cyber Systems. Adding depth and redundance to access controls is an effective method to protect physical access.

Responsible Entities may want to consider the following internal controls and best practices:

• Perform and document periodic walkdowns of assets containing low impact BES Cyber Systems to identify physical security deficiencies and ensure timely corrective actions are taken.
• Implement multiple independent controls to help ensure that if one safeguard fails, other controls continue to protect the asset(s) that contains low impact BES Cyber Systems.
• A structured key management process helps maintain accountability, reduce unauthorized physical access risks, and supports the effectiveness of the physical security plan.

For more information on physical controls and best practices, Texas RE encourages registered entities to review the physical and environmental (PE) protection family of security controls documented in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 5.